2 replaced http://stackoverflow.com/ with https://stackoverflow.com/
source | link

The point of encoding is not security related; it's just to make sure the link and html is valid and well-formed. Certain chars cannot be used in queryStringschars cannot be used in queryStrings, including the chars typically needed to form malicious JS commands.

Browsers attempt to interpret some mal-formed (under-escaped; like gets inlined with %22 etc) urls, so that example might work w/o escaping, but more complex scripts would fall flat without the "percent encoding" we use for URI search params.

The point of encoding is not security related; it's just to make sure the link and html is valid and well-formed. Certain chars cannot be used in queryStrings, including the chars typically needed to form malicious JS commands.

Browsers attempt to interpret some mal-formed (under-escaped; like gets inlined with %22 etc) urls, so that example might work w/o escaping, but more complex scripts would fall flat without the "percent encoding" we use for URI search params.

The point of encoding is not security related; it's just to make sure the link and html is valid and well-formed. Certain chars cannot be used in queryStrings, including the chars typically needed to form malicious JS commands.

Browsers attempt to interpret some mal-formed (under-escaped; like gets inlined with %22 etc) urls, so that example might work w/o escaping, but more complex scripts would fall flat without the "percent encoding" we use for URI search params.

1
source | link

The point of encoding is not security related; it's just to make sure the link and html is valid and well-formed. Certain chars cannot be used in queryStrings, including the chars typically needed to form malicious JS commands.

Browsers attempt to interpret some mal-formed (under-escaped; like gets inlined with %22 etc) urls, so that example might work w/o escaping, but more complex scripts would fall flat without the "percent encoding" we use for URI search params.